Non- Threshold Quantum Secret Sharing Schemes in the Graph State Formalism 
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In a recent work, Markham and Sanders have proposed a framework to study quantum secret sharing (QSS) 
schemes using graph states. This framework unified three classes of QSS protocols, namely, sharing classical 
secrets over private and public channels, and sharing quantum secrets. However, most work on secret sharing 
based on graph states focused on threshold schemes. In this paper, we focus on general access structures. We 
show how to realize a large class of arbitrary access structures using the graph state formalism. We show an 
equivalence between [[n, 1]] binary quantum codes and graph state secret sharing schemes sharing one bit. We 
also establish a similar (but restricted) equivalence between a class of [[n, 1]] Calderbank-Shor-Steane (CSS) 
codes and graph state QSS schemes sharing one qubit. With these results we are able to construct a large class 
of quantum secret sharing schemes with arbitrary access structures. 
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I. INTRODUCTION 

Quantum secret sharing (QSS) deals with the problem 
of sharing classical or quantum secrets using quantum infor- 
mation. Further, the secret sharing protocol could be operated 
in the presence or absence of eavesdroppers. In |[l2tl . a graph 
state formalism was proposed with a view to unifying all these 
variants under the same umbrella. This framework was useful 
in ways other than unifying the various quantum secret shar- 
ing protocols. For instance, building upon this framework, 
researchers have been able to propose new secret sharing pro- 
tocols |0], and make a connection with the measurment-based 
quantum computation model 1 1 Oil - More recently, it has mo- 
tivated research in graph theoretic concepts such as weak odd 
domination @]. 

The graph state framework does in principle include non- 
threshold access structures for quantum secrets. However, 
neither |T3l nor subsequent works irjU^ jTlll provide any pro- 
cedure to explicitly construct schemes with arbitrary access 
structures in the graph state formalism. The graph state frame- 
work in for quantum secret sharing approaches it from a per- 
spective other than quantum error-correction, in contrast to the 
theory as developed in lUEL flsll . But since any secret sharing 
protocol is ultimately an error-correcting code, the graph state 
schemes must be equivalent to those based on stabilizer codes 
and the protocols in lfl2ll must arise from quantum codes. But 
no results are known in this direction. 

The main contribution of this paper is to fill these gaps. 
We make transparent the connection between the graph state 
framework and the protocols presented using quantum codes. 
We show an equivalence between [[n, 1]] binary quantum 
codes and graph state protocols sharing one bit. We show 
a restricted equivalence between a class of [[n, 1]] CSS codes 
[Q]] and protocols sharing one qubit. We also translate many of 
the schemes developed using quantum codes into those based 
on the graph state formalism. 

We emphasize that our results are constructive and pro- 
vide concrete details for the construction of the secret sharing 



schemes as well as the associated details of recovery. 

We restrict ourselves to the qubit case in this paper, al- 
though as shown in [ 11] graph state secret sharing schemes 
can be extended to other alphabet. The general case involving 
qudits will be explored elsewhere. 



H. BACKGROUND 

A. Quantum secret sharing 

We briefly review the pertinent ideas of quantum secret 
sharing. We assume that the reader is familiar with quantum 
codes and the stabilizer formalism lll|3|]. In a secret sharing 
scheme, a dealer distributes an encrypted secret to a collection 
of players. Then certain subsets of players can collaboratively 
reconstruct the secret. Those subsets which can recover the 
secret are called authorized sets and those that cannot are said 
to be unauthorized sets. The collection of authorized sets is 
called the access structure of the scheme, which we denote as 
r. For an access structure to be valid, it must be monotonic, 
i.e., any set that contains an authorized set must also be an 
authorized set. An authorized set is said to be minimal if any 
proper subset of it is unauthorized. The collection of minimal 
authorized sets is called the minimal access structure. In a 
threshold scheme with threshold k, any subset consisting of k 
or more players can access the secret while those with fewer 
players cannot. In a general access structure, the authorized 
sets can be of different sizes and all subsets of that size need 
not be authorized. A collection of sets r gon is said to generate 
the access structure T, if every authorized set contains some 
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element of T 

A secret sharing scheme is said to be perfect if the unautho- 
rized sets cannot extract any information about the secret. In 
this paper we only consider perfect secret sharing schemes. 

When the secret to be shared is classical, the dealer dis- 
tributes a set of orthogonal quantum states that encode the se- 
cret. The following result, due to Gottesman, states the con- 
ditions that must be satisfied by authorized and unauthorized 
sets for sharing classical secrets through a QSS scheme. 
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Proposition 1 (Access conditions for classical secrets, fl). 
Suppose we have a set oforthonormal states encoding a 
classical secret. Then a set T is an unauthorized set iff 



mF^) = c(F) 



(1) 



independent of i for all operators F on T. The set T is autho- 
rized iff 



(4>i\E\1>j) = (i^j) 
for all operators E on the complement ofT. 



(2) 



If we were to share a quantum secret, then the access struc- 
ture, in addition to being monotonic, must also satisfy the no- 
cloning theorem [2]. This implies that no two authorized sets 
are disjoint. In this case the access structure must satisfy the 
conditions of Proposition QTfor any state in the space spanned 
by the encoded states, see |J, Theorem 1]. 



B. Review of graph state formalism for quantum secret 
sharing 

In 0, the quantum secret sharing protocols were classi- 
fied as follows: i) CC-This protocol deals with the sharing 
of classical secrets, where we assume that the players have 
secure channels, ii) CQ-In this protocol we share classical 
secrets where we assume that the channels between the play- 
ers are susceptible to eavesdropping, iii) QQ-This protocol 
shares quantum secrets using quantum channels. In this paper 
we restrict our attention to CC and QQ protocols. 

Let G be a graph with vertex set V(G). We denote the 
neighbours of a vertex v £ V(G) as N v . We denote the graph 
obtained by deleting the vertex v from G, by G \ v. The graph 
state defined on G is denoted |G). Recall that the graph state 
is a stabilizer state and satisfies K V \G) = |G), where 



K v = X v ] [ Z u , for all v g V(G). 



(3) 



uEN v 



We use the notation Ka = YiieA ^i- The stabilizer of |G) is 
denoted as 5(|G)). 

In the CC quantum secret sharing protocol, the secret bit s 
is encoded as 



Z S A \G) 



(4) 



where Z S A = flieA We denote a CC protocol using the 
graph G and encoding using the set A by (G, A). An autho- 
rized set T can recover the secret by either performing a joint 
measurement of an appropriate operator M 6 S'dG}) or by 
local measurements and combine these results classically (af- 
ter classical communication), in other words through LOCC. 

In the QQ protocol, the dealer needs to add an additional 
ancilla qubit whose state is the secret to be shared. The dealer 
then encodes this state by a procedure similar to teleporation. 
Following this the dealer might have to perform some correc- 
tion operations on the encoded state to ensure that the secret 
has been properly teleported. The dealer then distributes the 
qubits to the players. In this setting, authorized subsets of 



players can reconstruct the secret by means of suitable nonlo- 
cal operations. 

In fioll . the graph state secret sharing schemes were charac- 
terized in terms of graphical conditions. Define the odd neigh- 
bourhood of a set S C V(G) as 

Odd(S) = {v e V(G) | |JV„ n D\ = 1 mod 2} (5) 

Proposition 2 (Authorized sets for CC protocol, lUOIO. For 
the CC classical secret sharing protocols (G, A) of klAl . the 
secret can be accessed by a set S if there exists D C S such 
that 



D U Odd(D) C S 
\DllA\ = l mod 2 



(6) 
(7) 



Proposition 3 (Unauthorized sets for CC protocol, IlIolO . For 
the CC classical secret sharing protocols of [7^1 on G, the 
secret cannot be accessed by a set S if there exists a K £ 
V(G) \ S such that 



Odd{K) n s - A n s 



(8) 



The authors of fioll proved that these two conditions were 
sufficient and made the observation that it was open which 
graphs satisfy them. That these conditions are necessary as 
well was shown in 19l Lemma 2]. 



III. GRAPH STATE SCHEME FOR GENERAL ACCESS 
STRUCTURES 

A. Classical secrets 

In this section we make a connection between the CC pro- 
tocol in the graph state formalism and the standard error cor- 
rection model. We establish a correspondence between all 
graph state schemes sharing one bit and [[n, 1]] binary quan- 
tum codes. This provides an alternative characterization of the 
access structure of the CC secret sharing protocols. Further, 
Theorem Q] also generalizes the results of J3, which only 
uses CSS codes derived from self-dual codes. 

Theorem 1. Let Q be an [[n, 1, d]] quantum code with stabi- 
lizer matrix 



I r Ax A 2 




B C 

D I rl _ r -i E 



(9) 



where diag(B + CA\) = 0. Then the graph G with the adja- 
cency matrix Aq 



A G = 



B + CA l 2 Ax A 2 



A 2 








(10) 



gives rise to a CC quantum secret sharing protocol with 
(G, A), where A = supp([ C E 1 1 ]). A generating set for 
the access structure is given by 

Tgcn = { SU PP(<?)|5 is an encoded Z operator. } (1 1) 



3 



Proof. One choice of logical X and Z operators for Q is given 
by ' 



(12) 



Let |0) be the state stabilized by S and Z and |l) = X\0). 



' X ' 
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Then 



r X |0) 



•Z^|G). Therefore, up to local 



Clifford unitaries, the basis states of the CC secret sharing 
scheme induced by (G, A) and the basis states of Q are equiv- 
alent. Therefore the secret can be recovered if we can distin- 
guish between the states |0) and Consider We can rewrite 
the encoding for the CC protocol in terms of the basis states 
of Q as follows: 

£:s^X s \Q) = \ip s ). 

If to C {1, . . . , n} contains the support of an encoded Z 
operator, then we can recover the secret because ZX |0) = 
(— l) s Jf |0). Thus the support of any encoded Z operator 
gives an authorized set. 

If ui does not contain the support of a logical Z operator, 
then it is an unauthorized set. Let T be such an operator 
such that uj D supp(T) 2 supp(ZM), for any M e S. 
Let C(S) be the centralizer of S. If T £ C(S), then T 
is detectable, therefore (ip s \T\ip s ) =0. If T G S, then 
(ips\T\ip s ) = 1- If T G C{S) \ S and does not contain 
the support of an encoded Z operator, then it must be an 
encoded X or Y operator. Since \ip s ) — X |0), we have 
(ip s \T\ip s ) = (0|X s TX s |0) = 0, where we used the fact 
thatT|0) = a\T) for some a G C. Therefore, by Lemma [U 
ui is unauthorized. This shows that the access structure gen- 
erated by r gcn is complete and must coincide with the access 
structure as defined by Propositions|2]and[3] □ 

Remark 1. The requirement that B + C A\ = is not a re- 
striction because any such code can be transformed through 
local Clifford unitaries to a code which satisfies this condition. 
These two codes will lead to the same access structure. 

Our theorem gives a succinct characterization of the access 
structure, we just need to specify the stabilizer generators and 
the encoded Z operator. All the authorized sets can then be 
enumerated easily. There is no need to further check any other 
conditions on the sets. But note that our characterization does 
not give the minimal access structure but rather a generating 
set for the access structure. If we want to obtain the minimal 
access structure then we only need to look at those encoded 
Z operators which are also minimal in the sense they do not 
properly contain any other encoded Z operator within their 
support. 

Corollary 2. Let G be a connected graph with adjacency ma- 
trix Aq as in equation d 1 Ob . where A\, Ai are chosen arbi- 
trarily and B + CA\ is symmetric. Let A be an arbitrary 
subset of one of the bipartitions of the graph. Then (G, A) is 
a CC quantum secret sharing scheme. 

Two special cases of are worth highlighting because of their 
importance. 



(i) Ai = 0, then it can be seen that we are covering in ef- 
fect all possible graphs. Thus every graph leads to a CC 
quantum secret sharing scheme. 

(ii) B-\-CA\ = 0. This corresponds to the situation where G 
is bipartite. These secret sharing schemes are precisely 
those arising from an [[n, 1]] CSS code. 

If A2 = 0, then the access structure is trivial; the minimal 
access structure contains a singleton set. 

The framework as developed in J3l makes it possible to use 
mixed states for sharing classical secrets. At the present it 
is not clear how to include those schemes in the graph state 
formalism, since graph states are by definition pure and they 
lead to pure state quantum secret sharing schemes. Recall that 
a pure state scheme is one in which a pure state is encoded 
into a pure state. In a mixed state scheme a pure state could 
be encoded into a mixed state. Such schemes could be more 
efficient than the pure state schemes. 



B. Quantum secrets 

In this section, we use the graph state formalism to con- 
struct QQ quantum secret sharing schemes for general access 
structures. Every secret sharing scheme includes a step where 
the dealer encrypts the secret before distributing the shares. In 
lfTll IT2I1 . this was broken down into the following, steps. In 
the first step, the dealer prepares a graph state over the dealer's 
qubit and the players qubits. Then an ancilla qubit prepared 
in the secret state is entangled with the dealer's qubit. Then 
the ancilla and dealer's qubits are measured in the Bell basis 
leading to an encoded teleporation onto the players' qubits. 
In this paper we simplify these steps by involving only one 
additional qubit. We make use of the teleportation scheme to 
encode into a quantum code using graph states, see Qlzl]. 

We illustrate this procedure through an example. Consider 
the graph shown in Fig. [T] Pick any vertex of the graph, say 
we pick 0. The dealer prepares this qubit in the secret state to 
be shared. Then this qubit is entangled with the qubits in Nq 
using controlled-Z gates. Then we measure the dealer's qubit 
in the a x basis. If we measure 0, then the secret has been 
encoded as desired, otherwise, we need to apply a correction 
of the encoded Z on the state. The qubits are then distributed 
to the players. 

Consider the secret being encoded into Z^\G \ 0), where 
A = {4, 5, 7}. Then it can be verified that all the minimal au- 
thorized sets given in ro !m in satisfy both equations © and (jT]). 



TO,: 



{1,2,7};{1,3,5};{1,4,6};{2,3,4}; 

{2, 5, 6}; {3, 6, 7}; {4, 5, 7} / KL3} 



Lemma 3. Let G be a bipartite graph with adjacency matrix 
Aq given by 



A G 



P 
P t 



, where PP l = I. 



(14) 



Then for any set D C B, where B is in one of the bipartitions, 

(i) Odd(Odd(D)) = D. 

(ii) \Odd(D) fl Ni\ = mod 2 f or anyie B\D. 
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FIG. 1. (Color online) A general QQ secret sharing scheme from a 
bipartite graph. All qubits except the dealer's qubit are prepared in 
the |+) state, while the dealer's qubit (0) is prepared in the secret 
state. Then we apply CZ gates along the edges of G. The dealer's 
qubit is then measured in the a x basis. A correction operator is ap- 
plied if we measure one. 



Proof. Let g € be such that supp(g) = D. 

Then Odd{D) = supp(gA G ) and Odd(Odd(D)) = 
supp(gAQAc) = supp(g). Let h <E F£ be such that 
supp(/i) = Ni, Let h correspond to the ith row in Aq. Note 
that Odd(D) = supp(A G g*). To show that \Odd{D) n N 4 \ = 
mod 2, it is enough to prove that hAcg 1 = 0. This is zero 
because h is orthogonal to all but the ithe column of Aq. □ 

Theorem 4. Let G be a bipartite graph whose adjacency ma- 
trix Aq is given by 



Aq 



P 
P t 



, where PP t = I. 



(15) 



Then for every vertex i we can define a perfect QQ quantum 
secret sharing scheme from G. The encoding for the quantum 
secret sharing scheme is given by 



£ : a|0) + b\l) h+ a\G \i) + bZ% \G \ i). 



(16) 



A generating set for the access structure Ti is given by the 
following 



?, gen 



D U Odd(D) \ i 



DCV r 

\Dr\Ni\ = 1 mod 2 



(17) 



where V r is the bipartition of vertices of G that does not con- 
tain i. The encryption and recovery of the secret are as shown 
in Fig.\2\and\3\respectively. 



\i>) 

|G\i) 



H 



K' 



W) 



FIG. 2. Encrypting the secret state \tp) for QQ secret sharing using 
teleportation. The operator Kj — Xj YlkeN \i ^ k ls sucn tnat ^ 
Ni. It is applied only if the measurement outcome is 1. 



1+) 



H 



\G\i) 



FIG. 3. Reconstructing the secret state for QQ secret shar- 
ing given an authorized set D as in equation d!7t . The opera- 



tor K D 



U^n^U 



k€Odd(n)\i 



keOdd{n) 



Z k and U' D 



Proof. We shall prove this theorem in parts. For convenience, 
we shall ignore the normalization factors for quantum states. 

(i) Encryption of the secret: Assume that the secret to be 
encoded is \tp) ~ a\Q) + b\l). Then it can be easily ver- 
ified that in Fig. [2l the state |G \ i) is transformed to 
the following state prior measurement (up to normaliza- 
tion): 

|0)(a|G \ i) + bZ Nz \G \ *)) + |1) (a|G \ i) - bZ N , |G \ i)) 
If we measure zero, then we get the desired state but if 
we measure one, then we have to apply the correction 
operator Kj = Xj YikeN \i for any j <E Ni. This 
operator anti commutes with the operator Z^ t , but sta- 
bilizes the state |G \ i), therefore it acts as a correction 
operator to give the state in equation ( [ToT l. 

(ii) Recovery: Before we show that D U Odd(D) \ i is 
authorized, we need the following result. Note that 
K D = Y[ jeD Kj, therefore supp(A' D ) = D U Odd(D) 
and i e supp(A'd)- Because of the fact PP l = I, the 
element U D = X,JJ' D = UjeD Z jUkeOdd(D) X k G 
5(|G)). Let us write |G) as 

|G) = \0)\G\i) + \l)Z Ni \G\t), 
Then it follows that 

C7b|G) = |l>E^|G\i> + 
Hence, U' D Z^ i stabilizes |G \ i) 
With respect to the recovery observe that the set D U 
Odd(D) as in Eq. ( TFTb satisfies the requirements of 
Proposition [2 therefore if we trace through the circuit 
given in Fig. [5] the state transforms as follows: 

= (|0) + |l))(o|G\i) + 6Z^|G\i)) 

C =^ D |0)(o|G\i> + fcZ JVi |G\i» + 

\l)(aK D \G\i) + bK D Z Ni \G\i)) 

a\0)\G\i)+b\l)Z Nt \G\t) 

o|0)|G\*) + 6|l)|G\i) 

= (o|0) + 6|l»|G\i) 
where we used the fact that U' D ZN i stabilizes |G 
Thus D U Odd(D) \ i is able to reconstruct the quantum 
secret \tp). The no-cloning theorem now implies that the 
complement of this set is unauthorized. 



)U' D Z Ni \G\i). 



H 



c-U 



(iii) Completeness of Ti 



gen- 



Now we show that the ac- 
cess structure as defined in Eq. ( TFTb is complete in the 
sense that every authorized set contains some element of 

r 

Assume that there exists some set A which is autho- 



rized but not generated by Ti 



The complement of 
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this set is unauthorized. Let this be denoted as B. Let 
At = A n Ni and B t = B n iV 4 , then P; = Ni \ A,. 
Since B is unauthorized, it must have \Bi\ = mod 2 
or Odd(Bi) % B. (a) Suppose that it is the case that 
\Bi\ = mod 2. Since PP* = I , \Ni\ = 1 mod 2 
and |P,| = mod 2, it follows that \Ai\ = 1 mod 2. 
If Od<i(Ai) C A, then it is generated by r, )gen , there- 
fore, it must be the case that Odd(Ai) % A. By 
Lemma O Odd(Odd{i)) = Odd(Ni) = i it follows 
that Odd(B t ) = Odd(Ai) \ {i}. Consider the set 
C = Odd(Bi)\A. This has support only in the unautho- 
rized set B. Then Odd(C) U P; has an odd neighbour- 
hood which is given by Odd(Bi )\C and it lies entirely in 
A. Further, the set A' = A \ Odd(C) has an odd neigh- 
bourhood Odd(Bi) \ CUi. Thus the new set A' C A is 
an element of ri. gon contrary to assumption that A is not 
generated by T i!gen . 

(b) If on the other hand, |Pj| = 1 mod 2, then by exactly 
the same argument but reversing the roles of A and B, 
we see that B is generated by an element of rj, gcn and is 
therefore authorized. This would violate the no-cloning 
theorem as A and B are disjoint. Thus it is not possible 
for any authorized set to exist outside the access structure 
generated by r iigon . 
(iv) Perfectness of T i gcn : We also need to show that this 
scheme is perfect, namely, there are no unauthorized sets 
which although unable to reconstruct the secret are still 
able to extract some information about the secret. Be- 
cause it is a pure state scheme by construction, it is suffi- 
cient to show that the complement of an unauthorized set 
is authorized. This can be shown using almost the same 
argument as in (iii) but this time assuming that A and its 
complement B are both unauthorized. In this case argu- 
ing as (iii a), we would conclude that AeL contrary to 
the assumption that A is unauthorized or else arguing as 
in (iii b) we would conclude that B is authorized. This 
ensures that the QQ scheme constructed is perfect. 

□ 

The access structure realized by this scheme is same as 
the access structure realized by the quantum secret sharing 
scheme using the approach of quantum error correcting codes 
as the following result shows. 



Corollary 5. Let Qbean\ 
matrix, 

S 



' I 


p 





" 








I 


p 



, 0]] CSS code, with the stabilizer 



(18) 



where PP l = I. Then the [[n — 1,1]] quantum code obtained 
by puncturing the ith qubit realizes the QQ secret sharing pro- 
tocol of Theorem^ 

Proof. It suffices to show that the quantum states in Eq. dT6b 
form a basis for the quantum code obtained by puncturing the 
ith qubit. Without loss of generality we can assume that we 
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puncture the Oth qubit. Let P 



Q 



, where ((%) G F r 2 l and 



PP* = I. Then puncturing the ith qubit results in an \[n 
1,1]] quantum code. The stabilizer matrix for this code is 



I Q 


" 





/ Q 



while the encoded operators are given by 



" X ' 




' 


9 





" 


z 
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Consider the state stabilized by S and Z. Its stabilizer matrix 
is 



" I 


Q 





" 











9 








/ 


Q 



This matrix is equivalent to the following, through row trans- 
formations, 



'/ Q 


0" 





Q* I 



which is precisely the stabilizer of the state 
I®n/z-i-H® n l 2 \G\i). The state stabilized by S and X 
on the other hand is I® n / 2 - l H® n l 2 Z Ni ]G \ i). □ 

Remark 2. In this paper we have only considered secret shar- 
ing schemes where the share distributed to each party is of the 
same dimension as the dimension of the secret. Such schemes 
are said to be ideal. The graph state framework has not been 
used to study schemes which are not ideal. Such a need arises 
because there are some schemes that are not ideal. 

Our results make it possible to answer some questions re- 
lated to the graph state formalism very easily as exemplified 
by the following theorem. 

Theorem 6. There do not exist any graph state QQ secret 
sharing protocols for {{k, 2k — 1)) ifk > 4. 



supp(0| g) = Ni. Note that g ^ because of the requirement 



Proof. In 11311 . it was shown that every ((fc, 2k — 1)) quan- 
tum threshold secret sharing scheme is an [[2t — 1,1, t]] quan- 
tum MDS code. In it was shown that there do not exist 
any [[n, 1]] binary quantum MDS codes of length greater than 
5. It follows therefore, there are no (pure state) QQ quantum 
threshold schemes of length 2k — 1 greater than 5, equivalently 
k > 4. □ 

The existence of quantum threshold schemes was studied at 
great length in Jit]. Through the connection to quantum codes 
we are able to shed light on this issue, immediately improving 
upon the lower bound in [[§1 Corollary 4] . 



IV. CONCLUSION 

We showed how to construct quantum secret sharing 
schemes with arbitrary access structures using the graph state 
formalism. These results also elucidate the connection be- 
tween graph state framework and quantum secret sharing 
schemes based on quantum codes 
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